Cybersecurity researchers have identified a supply chain attack dubbed SleeperGem, which involves hijacking dormant RubyGems accounts to distribute malicious software payloads that establish persistence on developer machines.

Key Points

• Attackers compromised multiple RubyGems accounts to push malicious updates to packages including git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab.
• The malware avoids CI/CD build environments, specifically targeting developer workstations to install native daemons and establish persistence.
• Malicious payloads are fetched from a Forgejo host and can escalate privileges to root if the user has passwordless sudo access.
• Five packages were identified as carriers for the malicious dependency, potentially exposing users of slackHtmlToMarkdown, seo_optimizer, and array_fast_methods.
• Security experts recommend that affected users rotate all credentials and manually remove malicious files, including a setuid root shell found at /usr/local/sbin/ping6.

Why it Matters

This campaign highlights the significant security risks posed by dormant developer accounts, which are increasingly targeted for hijacking to bypass standard security scrutiny. The incident underscores the need for developers to audit dependencies and maintain strict account security to prevent the exploitation of trusted software registries.